Skip to contentArcadedata Arcadedb vulnerabilities
- arcadedata arcadedbArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol ConnectionsCVE-2026-1195777.6 High
- arcadedata arcadedbArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query EndpointCVE-2026-1195765.3 Medium
- arcadedata arcadedbArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block ListCVE-2026-1195757.1 High
- arcadedata arcadedbArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing AuthorizationCVE-2026-1140597.7 High
- arcadedata arcadedbArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt ProtocolCVE-2026-1140585.3 Medium
- arcadedata arcadedbArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information DisclosureCVE-2026-1140575.3 Medium
- arcadedata arcadedbArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITHCVE-2026-1140565.3 Medium
- arcadedata arcadedbArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundleCVE-2026-935987.1 High
- arcadedata arcadedbArcadeDB before 26.9.1 SSRF via IPv6 transition addressesCVE-2026-935975.3 Medium
- arcadedata arcadedbArcadeDB before 26.9.1 Authorization Bypass via Batch Edge ConnectCVE-2026-935965.3 Medium
- arcadedata arcadedbArcadeDB before 26.9.1 ACL Bypass via query_database ToolCVE-2026-935957.1 High
- arcadedata arcadedbArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeriesCVE-2026-935947.1 High
- arcadedata arcadedbArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type PermissionCVE-2026-935938.6 High
- arcadedata arcadedbArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSVCVE-2026-762258.3 High
- arcadedata arcadedbArcadeDB before 26.8.1 Remote Code Execution via Groovy FallbackCVE-2026-762248.7 High
- arcadedata arcadedbArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTIONCVE-2026-762237.1 High
- arcadedata arcadedbArcadeDB before 26.8.1 Path Traversal via create/drop databaseCVE-2026-75855Public exploit8.4 High
- arcadedata arcadedbArcadeDB Redis Wire-Protocol Plugin Missing AuthenticationCVE-2026-758549.3 Critical
- arcadedata arcadedbArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-DatabaseCVE-2026-758538.7 High
- arcadedata arcadedbArcadeDB MongoDB wire protocol authentication bypass cross-databaseCVE-2026-758529.3 Critical
- arcadedata arcadedbArcadeDB before 26.8.1 Authentication Bypass via Async CommandCVE-2026-758519.4 Critical
- arcadedata arcadedbArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch HandlersCVE-2026-758502.3 Low
- arcadedata arcadedbArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTIONCVE-2026-758467.1 High
- arcadedata arcadedbArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_settingCVE-2026-758455.3 Medium
- arcadedata arcadedbArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypassCVE-2026-758447.1 High
- arcadedata arcadedbArcadeDB before 26.8.1 Privilege Escalation via gRPC TransactionCVE-2026-758439.4 Critical
- arcadedata arcadedbArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSVCVE-2026-758428.3 High
- arcadedata arcadedbArcadeDB before 26.8.1 Denial of Service via range()CVE-2026-758415.3 Medium
- arcadedata arcadedbArcadeDB before 26.8.1 Arbitrary File Read via Unescaped RegexCVE-2026-758408.7 High
- arcadedata arcadedbArcadeDB before 26.8.1 Information Disclosure via Cluster EndpointsCVE-2026-758395.3 Medium
- arcadedata arcadedbArcadeDB before 26.7.3 Authentication Bypass via MCP TransportCVE-2026-685787.7 High
- arcadedata arcadedbArcadeDB before 26.7.3 Information Disclosure via get_server_settingsCVE-2026-673577.7 High
- arcadedata arcadedbArcadeDB before 26.7.3 Privilege Escalation via JavaScript TriggerCVE-2026-673568.7 High
- arcadedata arcadedbArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPECVE-2026-673448.5 High
- arcadedata arcadedbArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/serverCVE-2026-673438.7 High
- arcadedata arcadedbArcadeDB before 26.7.2 Authorization Bypass via Database HandlersCVE-2026-67342Fix available9.3 Critical
- arcadedata arcadedbArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTIONCVE-2026-67341Fix available9.3 Critical
- arcadedata arcadedbArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsCVE-2026-67340Public exploitFix available8.6 High
- arcadedata arcadedb, com.arcadedb arcadedb-server +1 moreArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file readCVE-2026-65831Fix available7.7 High
- arcadedata arcadedb, com.arcadedb arcadedb-engine +1 moreArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)CVE-2026-54076Fix available8.1 High
- arcadedata arcadedb, com.arcadedb arcadedb-engine +1 moreArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated usersCVE-2026-54077Fix available7.1 High
- arcadedata arcadedbArcadeDB: Cross-database authorization bypass and unsecured newly-created databasesCVE-2026-44221Fix available9.0 Critical